Grafana 11.1.2 → 11.6.3
55 releases · 3 breaking changes · 46 security fixes · 1 advisory fixed
46security3breaking0deprecated230feature195fix
Vulnerabilities fixed by this upgrade
- 9.1 CVE-2026-27876 A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
Breaking changes
- breaking Data source: Change Permissions for query to only have query and not read OR query (Enterprise) in 11.6.0
- breaking Loki: Default to /labels API with query param instead of /series API in 11.5.0
- breaking Folders: Allow folder editors and admins to create subfolders without any additional permissions in 11.2.0
Security changes
- security Security: Fixes CVE-2025-3415 in 11.6.3
- security Security: Fix CVE-2025-3454 in 11.6.2
- security Security: Fix CVE-2025-2703 in 11.6.2
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.6.1
- security Chore: Update JWT library (CVE-2025-30204) in 11.6.1
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923 in 11.6.1
- security Security: Fix CVE-2025-3454 in 11.6.1
- security Security: Fix CVE-2025-2703 in 11.6.1
- security Security: Fix CVE-2025-3260 in 11.6.1
- security Fixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa… in 11.6.0
- security Chore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786 in 11.6.0
- security App Platform: Pin bleve to fix CVE-2022-31022 in 11.6.0
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.5.7
- security Security: Fixes CVE-2025-3415 in 11.5.6
- security Security: Fix CVE-2025-3454 in 11.5.5
- security Security: Fix CVE-2025-2703 in 11.5.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.5.4
- security Dependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923 in 11.5.4
- security Security: Fix CVE-2025-3454 in 11.5.4
- security Security: Fix CVE-2025-2703 in 11.5.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.4.7
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.4.6
- security Security: Fixes CVE-2025-3415 in 11.4.6
- security Security: Fix CVE-2025-3454 in 11.4.5
- security Security: Fix CVE-2025-2703 in 11.4.5
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.4.4
- security Security: Fix CVE-2025-3454 in 11.4.4
- security Security: Fix CVE-2025-2703 in 11.4.4
- security Security: Fixes for CVE-2025-6197 and CVE-2025-6023 in 11.3.9
- security Dependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371 in 11.3.8
- security Security: Fixes CVE-2025-3415 in 11.3.8
- security Security: Fix CVE-2025-3454 in 11.3.7
- security Security: Fix CVE-2025-2703 in 11.3.7
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.3.6
- security Security: Fix CVE-2025-3454 in 11.3.6
- security Security: Fix CVE-2025-2703 in 11.3.6
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.3.0
- security Security: Fix CVE-2025-3454 in 11.2.10
- security Security: Fix CVE-2025-2703 in 11.2.10
- security Fixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten… in 11.2.9
- security Security: Fix CVE-2025-3454 in 11.2.9
- security Security: Fix CVE-2025-2703 in 11.2.9
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.2.3
- security Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] in 11.1.8
- security Alerting: Fixed CVE-2024-8118. in 11.1.7
- security Swagger: Fixed CVE-2024-6837. in 11.1.4
Every release in between
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.4-git to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.6 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
fixDashboard: Fixes issue with row repeats and first row
fixGraphite: Ensure template variables are interpolated correctly
fixGraphite: Fix Graphite series interpolation
fixPrometheus: Fix semver import path
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
securityChore: Update JWT library (CVE-2025-30204)
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.7.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featureGrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
featurePrometheus: Add support for cloud partners Prometheus data sources
fixAlertmanager: Add Role-Based Access Control via reqAction Field
fixGrafanaUI: Remove blurred background from overlay backdrops to improve performance
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
fixOrg redirection: Fix linking between orgs
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securitySecurity: Fix CVE-2025-3260
securityFixes CVE-2026-27876: A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are alwa…
featureAPI keys: Migrate API keys to service accounts at startup
featureAccessControl: Allow plugin roles to include plugins:write
featureAlerting: Add DAG errors to alert rule creation and view
featureAlerting: Add Jira integration to cloud AMs
featureAlerting: Add alert rule version history - part1
featureAlerting: Add migration to clean up rule versions table
featureAlerting: Add multiple threshold operators
featureAlerting: Add tracking for the mode used in query and notifications step when c…
featureAlerting: Adding color option for slack receiver
featureAlerting: Allow selection of recording rule write target on per-rule basis.
featureAlerting: Allow specifying uid for new rules added to groups
featureAlerting: Improve template testing by trying non-root scopes
featureAlerting: Include time range in template dashboard and panel urls
featureAlerting: Keep the latest version of deleted rule in version table
featureAlerting: Promote alertingSaveStateCompressed flag to public preview
featureAlerting: Remove ID and OrgID from hash calculation
featureAlerting: Remove feature toggle alertingNoNormalState
featureAlerting: Remove rule group edit from single rule editor
featureAlerting: Return 404 when /api/ruler/grafana/api/v1/rules/{Namespace}/{Groupname} does not exist
featureAlerting: Rule history restore feature
featureAlerting: Support Jira Integration
featureAlerting: Track if new gm rules are created with queries and expressions transformable to simple mode
featureAlerting: Update IRM copies in Configuration Tracker
featureAlerting: Update design of rule details tab and add updated by
featureAlerting: Update irm links for incident and oncall in case new irm plugin is present
featureAlerting: Use exponential backoff in the remote Alertmanager readiness check
featureAlerting: Use uid instead of id in AnnotationsStateHistory
featureAuth: Add IP address login attempt validation
featureAuth: Add support for the TlsSkipVerify parameter to JWT Auth
featureAuth: Make ssoSettingsSAML GA and enabled by default
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Resource picker improvements
featureAzure: Variable editor and resource picker improvements
featureBadge: Add darkgrey color
featureCanvas: One click links and actions
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
securityChore: Bump github.com/expr-lang/expr to v1.17.0 to address CVE-2025-29786
securityApp Platform: Pin bleve to fix CVE-2022-31022
+105 more items in the release notesfeatureGo: Update to 1.25.2 + golangci-lint v2.5.0 + golang.org/x/net v0.45.0
featureGo: Update to 1.25.3
fixAuth: Fix render user OAuth passthrough
fixLDAP Authentication: Fix URL to propagate username context as parameter
fixPlugins: Dependencies do not inherit parent URL for preinstall
featureAuditing: Add settings to control recording of datasource query request and response body (Enterprise)
featureAuditing: Document new options for recording datasource query request/response body
fixFix: Fix redirection after login when Grafana is served from subpath
featureGo: Update to 1.24.6
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
fixAzure: Fix resource name determination in template variable queries
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.3 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.126.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureAzure Monitor: Filter namespaces by resource group
featureAzure: Add support for custom namespace and custom metrics variable queries
featureAzure: Resource picker improvements
featureAzure: Support more complex variable interpolation
featureAzure: Variable editor and resource picker improvements
featureChore: Update CVE-affected dependencies
featureDashboardScenePage: Correct slug in self referencing data links
securityDependencies: Bump github.com/redis/go-redis/v9 to 9.6.3 to address CVE-2025-29923
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
featurePrometheus: Add support for cloud partners Prometheus data sources
fixInfluxDB: Fix nested variable interpolation
fixLDAP test: Fix page crash
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixAuth: Fix AzureAD config UI's ClientAuthentication dropdown
fixDashboard: Fix the unintentional time range and variables updates on saving
fixDashboards: Fix missing v/e/i keybindings to return back to dashboard
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixOrg redirection: Fix linking between orgs
featureDocker: Use our own glibc 2.40 binaries
featureTransformationFilter: Include transformation outputs in transformation filtering options
featuregrafana-ui: Update InlineField error prop type to React.ReactNode
fixAlerting: Allow specifying uid for new rules added to groups
fixAlerting: Call RLock() before reading sendAlertsTo map
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixCodeEditor: Fix cursor alignment
fixDashboardList: Throttle the re-renders
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
fixCodeEditor: Fix cursor alignment
fixTransformationFilter: Include transformation outputs in transformation filtering options: Include transformation outputs in transformation filtering options
featureCloudMigration: Create authapi service
featureAlerting: Add new button for exporting new alert rule in HCL format
featureAlerting: Add option to show inactive alerts in alert list panel
featureAlerting: Add state_periodic_save_batch_size config option
featureAlerting: Change default for max_attempts to 3.
featureAlerting: Consume k8s API for notification policies tree
featureAlerting: Enable flag alertingApiServer by default
featureAlerting: Explore button in Insights view
featureAlerting: Improve performance ash page
featureAlerting: Make alert rule policies preview use k8s API
featureAlerting: Return default builtin templates in k8s templategroup API and UI
featureAlerting: Simplify notification step
featureAlerting: Update state manager to take image only once per rule evaluation
featureAnalytics Views: Deprecate :dashboardID endpoints in favor of uid/:dashboardUID (Enterprise)
featureAnalytics: Summaries: Deprecate dashboard_id endpoints in favor of dashboard_uid (Enterprise)
featureAnnouncement Banners: Enable feature for all cloud tiers (Enterprise)
featureAnnouncement banner: Remove feature toggle
featureAnnouncement banner: Remove feature toggle (Enterprise)
featureAnnouncement banner: Sort by last updated (Enterprise)
featureAuth: Return error when retries have been exhausted for OAuth token refresh
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureAzure: Improve Azure Prometheus exemplars UI/UX
featureAzure: Unify credentials in frontend for Prometheus
featureChore: Bump Go to 1.23.4
featureChore: Bump Go to 1.23.4 (Enterprise)
featureChore: Remove experimental Storage UI
featureChore: Update to node 22
featureCloudMigrations: Enable feature toggle by default in 11.5
featureCloudMigrations: Introduce RBAC role for migration assistant
featureCloudWatch: Add OpenSearch PPL and SQL support in Logs Insights
featureCloudWatch: Batch different time ranges separately
featureCloudwatch: Accept empty string for logstimeout and mark errors downstream
featureCloudwatch: Update grafana-aws-sdk for AWS/AmplifyHosting metrics
featureDashboard Scene: Shows usages in variables list
featureDashboards: Add option to specify explicit percent change text size for stat panels
featureDashboards: Allow DashboardDS subqueries in MixedDS
featureDashboards: Update docs of the overwrite param in Save Dashboard API Call
featureDatasources: Add toggle to control default behaviour of 'Manage alerts via Alerts UI' toggle
featureDatasources: Allow clearing trace to logs, metrics and profiles datasource pickers
breakingLoki: Default to /labels API with query param instead of /series API
+111 more items in the release notesfeatureGo: Update to 1.24.6
fixDashboards: Panel react for timeFrom and timeShift changes using variables
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureGo: Bump to 1.24.2 (Enterprise)
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixInfluxDB: Improve handling of template variables contained in regular expressions (InfluxQL)
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAuthN: Refetch user on "ErrUserAlreadyExists"
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
fixRBAC: Don't check folder access if annotationPermissionUpdate FT is enabled
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.4.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAlerting: Fix alert rules unpausing after moving rule to different folder
fixAlerting: Fix label escaping in rule export
fixAlerting: Fix slack image uploading to use new api
fixAzure/GCM: Improve error display
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDashboards: Panel react for timeFrom and timeShift changes using variables
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixLibraryPanel: Fallback to panel title if library panel title is not set
fixGrafana UI: Re-add react-router-dom as a dependency
featureCloudwatch: OpenSearch PPL and SQL support in Logs Insights
featureDependencies: Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
fixAzure: Fix legend formatting
securitySecurity: Fixes for CVE-2025-6197 and CVE-2025-6023
featureDependencies: Bump Go to v1.24.4
securityDependencies: Bump github.com/openfga/openfga to v1.8.13 to address CVE-2025-48371
securitySecurity: Fixes CVE-2025-3415
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/blevesearch/bleve/v2 from v2.4.2 to v2.5.0
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureChore: Update libs with CVE in dependencies
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
fixAuth: Fix SAML user IsExternallySynced not being set correctly
fixAuthN: Refetch user on "ErrUserAlreadyExists"
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go to 1.23.7
featureChore: Bump Go to 1.23.7 (Enterprise)
fixAlerting: Fix token-based Slack image upload to work with channel names
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAuth: Fix redirect with JWT auth URL login
fixAzure: Correctly set application insights resource values
fixDashboards: Bring back scripted dashboards
fixPlugin Metrics: Eliminate data race in plugin metrics middleware
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x
featureSecurity: Update to Go 1.23.5 - Backport to v11.3.x (Enterprise)
fixAlerting: AlertingQueryRunner should skip descendant nodes of invalid queries
fixAzure/GCM: Improve error display
fixDashboard: Fixes issue with compatability of old DashboardModel.annotations
fixDashboards: Fix issue where filtered panels would not react to variable changes
fixDashboards: Fixes issue with panel header showing even when hide time override was enabled
fixDashboards: Fixes week relative time ranges when weekStart was changed
fixDateTimePicker: Fixes issue with date picker showing invalid date
fixFix: Add support for datasource variable queries
fixInfluxDB: Adhoc filters can use template vars as values
fixUnified Storage: Use tls preferred when grafana db using ssl
fixGrafana UI: Re-add react-router-dom as a dependency
featureBackport: Announcement Banners: Enable feature for all cloud tiers (Enterprise)
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Fix escaping of silence matchers in utf8 mode
fixAlerting: Fix overflow for long receiver names
fixAlerting: Fix saving advanced mode toggle state in the alert rule editor
fixAlerting: Fix setting datasource uid, when datasource is string in old version
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixCloudWatch: Interpolate region in log context query
fixDashboard datasource: Return annotations as series when query topic is "annotations"
fixDashboard: Append orgId to URL
fixDashboards: Fixes performance issue expanding a row
fixFlame Graph: Fix crash when it receives empty data
fixFolders: Add admin permissions upon creation of a folder w. SA
fixFolders: Don't show error pop-up if the user can't fetch the root folder
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixServerLock: Fix pg concurrency/locking issue
fixService Accounts: Run service account creation in transaction
fixTable: Fix text wrapping applying to wrong field
fixUnified Storage: Use ssl_mode instead of sslmode
featureAlerting: Add manage permissions UI logic for Contact Points
featureAlerting: Allow linking to silence form with alert_rule_uid value preset
featureAlerting: Hide query name when using simplified mode in the alert rule
featureAlerting: Limit and clean up old alert rules versions
featureAlerting: Style nits for the simple query mode
featureAlerting: Update texts in annotations step
featureAlerting: Use useProduceNewAlertmanagerConfiguration for contact points
featureAuth: Attach external session info to Grafana session
featureAuth: Replace jmespath/go-jmespath with jmespath-community/go-jmespath
featureCloudMigrations: Add support for migration of Library Elements (Panels) resources
featureCloudwatch: Update grafana-aws-sdk
featureExplore Logs: Preinstall for onprem Grafana instances
featureExploreMetrics: Ensure compatibility with Incremental Querying
featureFieldConfig: Add support for Actions
featurePlugin Extensions: Require meta-data to be defined in plugin.json during development mode
featureReporting: Display template variables in the PDF (Enterprise)
featureTempo: Add deprecation notice for Aggregate By
fixAlerting/Chore: Fix TimeRangeInput not working across multiple months
fixAlerting: Fix default value for input in simple condition
fixAlerting: Fix eval interval not being saved when creating a new group
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAlerting: Fix panics when attempting to create an Alertmanager after failing
fixDashboardScene: Fixes url issue with subpath when exiting edit mode
fixDashboards: Enable scenes by default
fixDashboards: Fixes view & edit keyboard shortcuts when grafana is behind a subpath
fixElasticSearch: Fix errorsource in newInstanceSettings
fixReporting: Fix reports on multi-org instance (Enterprise)
fixSubMenu: Fix expanding sub menu items on touch devices
featureChore: Bump Go version to 1.24.3
featureDependencies: Bump github.com/openfga/openfga from v1.8.5 to v1.8.12
featureDependencies: Unpin and bump github.com/getkin/kin-openapi from v0.125.0 to v0.132.0
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
securityFixes CVE-2025-4123: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a fronten…
featureChore: Update libs with CVE in dependencies
featureGo: Bump to 1.24.2
featureGo: Bump to 1.24.2 (Enterprise)
fixAuth: Fix SAML user IsExternallySynced not being set correctly
fixAuthN: Refetch user on "ErrUserAlreadyExists"
securitySecurity: Fix CVE-2025-3454
securitySecurity: Fix CVE-2025-2703
featureChore: Bump Go version to 1.23.7
featureChore: Bump Go version to 1.23.7 (Enterprise)
fixAlerting: Update slack image upload to use new API
fixCloudMigrations: Fix OrderBy clause in GetSnapshotList sql handler
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureDocker: Use our own glibc 2.40 binaries
fixAzure: Correctly set application insights resource values
featureAzure Monitor: Add a feature flag to toggle user auth for Azure Monitor only
featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x
featureSecurity: Update to Go 1.22.11 - Backport to v11.2.x (Enterprise)
fixAzure/GCM: Improve error display
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureMigrationAssistant: Restrict dashboards, folders and datasources by the org id of the signed in user
featureTransformations: Add 'transpose' transform
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixFolders: Add admin permissions upon creation of a folder w. SA
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixServerLock: Fix pg concurrency/locking issue
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries
fixCanvas: Allow API calls to grafana origin
fixFolders: Correctly show new folder button under root folder
fixOrgSync: Do not set default Organization for a user to a non-existent Organization
fixPlugins: Skip install errors if dependency plugin already exists
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
featureChore: Bump Go to 1.22.7
featureChore: Bump Go to 1.22.7 (Enterprise)
featureData sources: Hide the datasource redirection banner for users who can't interact with data sources
fixAlerting: Fix preview of silences when label name contains spaces
fixAlerting: Make query wrapper match up datasource UIDs if necessary
fixAzureMonitor: Deduplicate resource picker rows
fixAzureMonitor: Improve resource picker efficiency
fixAzureMonitor: Remove Basic Logs retention warning
fixCloudWatch: Fix segfault when migrating legacy queries
fixCorrelations: Limit access to correlations page to users who can access Explore
fixDashboardScene: Fix broken error handling and error rendering
fixPlugins: Avoid returning 404 for AutoEnabled apps
featureAlerting: Support for optimistic concurrency in priovisioning Tempate API
featureLogs panel: Enable displayedFields in dashboards and apps
featureState timeline: Add pagination support
fixAuthn: No longer hash service account token twice during authentication
fixCloudMigrations: Fix snapshot creation on Windows systems
fixDashGPT: Fixes issue with generation on Safari
fixDashboard: Fix Annotation runtime error when a data source does not support annotations
fixGrafana SQL: Fix broken import in NumberInput component
fixLogs: Show older logs button when infinite scroll is enabled and sort order is descending
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to (Enterprise)
fixReporting: Disable dashboardSceneSolo when rendering PDFs the old way (Enterprise)
fixTemplating: Fix searching non-latin template variables
fixTutorialCard: Fix link to tutorial not opening
fixAutoSizeInput: Allow to be controlled by value
feature@grafana/data: Introduce new getTagKeys/getTagValues response interface
featureAWS: Update deprecated aws-sdk functions from env variable versions
featureAlerting: Add ha_reconnect_timeout configuration option
featureAlerting: Add setting for maximum allowed rule evaluation results
featureAlerting: Add warning in telegram contact point
featureAlerting: Central alert history part4
featureAlerting: Don't crash the page when trying to filter rules by regex
featureAlerting: Enable remote primary mode using feature toggles
featureAlerting: Hide edit/view rule buttons according to deleting/creating state
featureAlerting: Implement UI for grafana-managed recording rules
featureAlerting: Improve performance of /api/prometheus for large numbers of alerts.
featureAlerting: Include a list of ref_Id and aggregated datasource UIDs to alerts when state reason is NoData
featureAlerting: Instrument outbound requests for Loki Historian and Remote Alertmanager with tracing
featureAlerting: Limit instances on alert detail view unless in instances tab
featureAlerting: Make alert group editing safer
featureAlerting: Make whitespace more visible on labels
featureAlerting: Remove option to return settings from api/v1/receivers and restrict provisioning action access
featureAlerting: Resend resolved notifications for ResolvedRetention duration
featureAlerting: Show Insights page only on cloud (when required ds's are available)
featureAlerting: Show repeat interval in timing options meta
featureAlerting: Support median in reduce expressions
featureAlerting: Track central ash interactions
featureAlerting: Update alerting state history API to authorize access using RBAC
featureAlerting: Update warning message for Telegram parse_mode and default to empty value
featureAlerting: Use Runbook URL label everywhere and add validation in the alert rule…
featureAlerting: Use cloud notifier types for metadata on Cloud AMs
featureAlerting: Use stable identifier of a group when export to HCL
featureAlerting: Use stable identifier of a group,contact point,mute timing when export to HCL
featureAlertmanager: Support limits for silences
featureAngular deprecation: Disable dynamic angular inspector if CheckForPluginUpdates is false
featureApp events: Add "info" variant
featureAuth: Add org to role mappings support to AzureAD/Entra integration
featureAuth: Add organization mapping configuration to the UI
featureAuth: Add support for escaping colon characters in org_mapping
featureAzure: Add new Azure infrastructure dashboards
featureBrowseDashboards: Update results when starred param changes
featureCaching: Handle memcached reconnects
featureCalendar: Add labels for next/previous month
featureCanvas: Element level data links
breakingFolders: Allow folder editors and admins to create subfolders without any additional permissions
+142 more items in the release notesfeatureChore: Bump Go version to 1.23.7
featureChore: Bump Go version to 1.23.7 (Enterprise)
fixAlerting: Update slack image upload to use new API
fixService Accounts: Do not show error pop-ups for Service Account and Renderer UI flows
featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x
featureSecurity: Update to Go 1.22.11 - Backport to v11.1.x (Enterprise)
fixAzure/GCM: Improve error display
fixFix: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
featureAlerting: Make context deadline on AlertNG service startup configurable
featureUser: Check SignedInUser OrgID in RevokeInvite
fixAlerting: Force refetch prom rules when refreshing panel
fixAnonymous User: Adds validator service for anonymous users
fixAnonymous User: Adds validator service for anonymous users (Enterprise)
fixAzure Monitor: Support metric namespaces fallback
fixAzure: Fix duplicated traces in multi-resource trace query
fixAzure: Handle namespace request rejection
fixMigration: Remove table aliasing in delete statement to make it work for mariadb
fixPrometheus: Fix interpolating adhoc filters with template variables
fixServerLock: Fix pg concurrency/locking issue
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
securityAlerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118]
fixAzureMonitor: Fix App Insights portal URL for multi-resource trace queries
fixOrgSync: Do not set default Organization for a user to a non-existent Organization
fixServerSideExpressions: Disable SQL Expressions to prevent RCE and LFI vulnerability
featureChore: Bump Go to 1.22.7
featureChore: Bump Go to 1.22.7 (Enterprise)
fixAlerting: Fix preview of silences when label name contains spaces
fixAlerting: Make query wrapper match up datasource UIDs if necessary
fixAzureMonitor: Deduplicate resource picker rows
fixAzureMonitor: Improve resource picker efficiency
fixAzureMonitor: Remove Basic Logs retention warning
fixCorrelations: Limit access to correlations page to users who can access Explore
fixPlugins: Avoid returning 404 for AutoEnabled apps
securityAlerting: Fixed CVE-2024-8118.
featureChore: Update swagger ui (4.3.0 to 5.17.14)
fixTemplating: Fix searching non-latin template variables
fixTutorialCard: Fix link to tutorial not opening
fixBugfix: QueryField typeahead missing background color
fixAlerting: Fix permissions for prometheus rule endpoints
fixAlerting: Fix persisting result fingerprint that is used by recovery threshold
fixAuditing: Fix a possible crash when audit logger parses responses for failed requests (Enterprise)
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they don't belong to
fixRBAC: Fix an issue with server admins not being able to manage users in orgs that they dont belong to (Enterprise)
fixRBAC: Fix seeder failures when inserting duplicated permissions (Enterprise)
fixSnapshots: Fix panic when snapshot_remove_expired is true
fixVizTooltip: Fix positioning at bottom and right edges on mobile
fixBugfix: QueryField typeahead missing background color
securitySwagger: Fixed CVE-2024-6837.
fixRBAC: Allow plugins to use scoped actions